An enterprise is architecting a mission-critical, three-tier application (Web, Application, and Database tiers) across dedicated subnets within a Google Cloud Shared VPC. The central security team requires strict boundary segmentation with the following requirements: Communication must be strictly enforced between adjacent tiers only (Web to App, and App to Database), explicitly blocking lateral movement and direct Web-to-Database access. Workload administrators within service projects must be prevented from bypassing network security boundaries by modifying instance-level metadata or network attributes. Policies must be managed centrally by the security organization and enforced consistently across all environments. Which network security design should the enterprise implement to satisfy these requirements?

Implement hierarchical firewall policies at the organization or folder level using Resource Manager secure tags and service account identities to restrict ingress between adjacent tiers.: ### What Hierarchical Firewall Policies with Secure Tags Are **Hierarchical firewall policies** allow security administrators to define and enforce consistent firewall rules across the entire resource hierarchy (organization, folders, and projects) in Google Cloud. When combined with **Resource Manager secure tags** and **service account identities**, access control is bound directly to verified identity and governed metadata rather than mutable network properties or legacy network tags. ### How It Meets the Requirements - **Strict adjacent tier communication**: Ingress rules can specify secure tags or service accounts as source and target parameters (e.g., allowing ingress on the application tier only when traffic originates from instances bearing the `tagKeys/env/tagValues/web` tag), ensuring strict east-west segmentation. - **Preventing developer bypass**: Unlike legacy network tags, **Resource Manager tags** are governed by granular IAM permissions (`roles/resourcemanager.tagUser`). Workload administrators with compute instance edit permissions cannot add or remove secure tags unless explicitly granted tag administration rights, preventing unauthorized privilege escalation or boundary bypass. - **Centralized enforcement**: Hierarchical firewall policies are created at the folder or organization level, meaning they take precedence over VPC-level rules and cannot be overridden or deleted by service project administrators. ### Key Advantages and Capabilities - **Identity-based enforcement**: Enforces traffic filtering based on cryptographic identity (service accounts) and centrally governed tags. - **Immutable guardrails**: Guarantees organizational compliance across all Shared VPC service projects. - **Inherited governance**: Automatically applies to any newly provisioned virtual machine instances inheriting the folder or organization policy hierarchy. - **Separation of duties**: Keeps network security policy administration strictly with the central SecOps team. ### Why This Is Optimal This solution provides tamper-proof, centrally administered boundary protection that couples identity-aware filtering with hierarchical policy controls, preventing lateral movement without requiring complex routing topologies or external appliances.

Hierarchical Firewalls Secure Tags Ntier Segmentation | Professional Cloud Security Engineer

Hierarchical Firewalls Secure Tags Ntier Segmentation

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is architecting a mission-critical, three-tier application (Web, Application, and Database tiers) across dedicated subnets within a Google Cloud Shared VPC. The central security team requires strict boundary segmentation with the following requirements:

Communication must be strictly enforced between adjacent tiers only (Web to App, and App to Database), explicitly blocking lateral movement and direct Web-to-Database access.
Workload administrators within service projects must be prevented from bypassing network security boundaries by modifying instance-level metadata or network attributes.
Policies must be managed centrally by the security organization and enforced consistently across all environments.

Which network security design should the enterprise implement to satisfy these requirements?

Implement hierarchical firewall policies at the organization or folder level using Resource Manager secure tags and service account identities to restrict ingress between adjacent tiers.

Apply VPC-level firewall rules using legacy network tags on Compute Engine instances to restrict ingress and egress between tier subnets.

Configure Google Cloud Armor security policies attached directly to tier subnets and expose intermediate tiers using Private Service Connect endpoints.

Deploy each application tier into separate VPC networks connected via VPC Network Peering with static route next-hops targeting internal passthrough Network Load Balancers.

Professional Cloud Security Engineer

Hierarchical Firewalls Secure Tags Ntier Segmentation

Related questions